Addresses synchronization issue where backing up large Resilient File System (ReFS) volumes may lead to errors 0xc2 and 7E.

Addresses issue where the UWF file commit adds old data to files in certain scenarios.

Addresses issue where access-based enumeration may not work as expected in some scenarios after you install KB4015217 or later. For example, a user may be able to view another user's folder to which they don't have access rights.

Addresses issue where AD FS incorrectly displays the Home Realm Discovery (HRD) page when an identity provider (IDP) is associated with a relying party (RP) in an OAuth Group. Unless multiple IDPs are associated with the RP in the OAuth Group, the user isn't shown the HRD page. Instead, the user is navigated directly to an associated IDP for authentication.

Addresses issue where PKeyAuth-based device authentication sometimes fails in Internet Explorer and Microsoft Edge when AD FS returns a context that exceeds the request limits for URL length. Event 364 is logged in the AD FS 2.0 Admin log with the following exception details: “System.Security.Cryptography.CryptographicException: The signature is not valid. The data may have been tampered with….”

Addresses issue where retrieving the Certificate Revocation List (CRL) from the Certification Authority (CA) using the Simple Certificate Enrollment Protocol (SCEP) fails. Users see event ID 45, which says, "NDES cannot match issuer and serial number in the device request with any Certification Authority (CA) Certificate”.

Enables IT administrators to scientifically troubleshoot I/O failures using a comprehensive event log for the resiliency state transition.

Provides transparency about replication health. It represents the state of replication by indicating when:

The free disk space is running low.

The Hyper-V Replica Log (HRL) size is growing to its maximum limit.

The Recovery Point Objectives (RPO) threshold has been violated.

Addresses issue where, if the Online Certificate Status Protocol (OCSP) renewal date comes after the certificate expiration date, the OCSP-stapled response is used until the renewal date even though the certificate has expired.

Addresses issue where backwards compatibility for managing Microsoft User Experience Virtualization (UE-V) with group policy is lost. Windows 10 version 1607 group policy isn't compatible with Windows 10 version 1703 or higher group policy. Because of this bug, the new Windows 10 Administrative Templates (.admx) cannot be deployed to the Group Policy Central Store. This means that some of the new, additional settings for Windows 10 aren't available.

Addresses issue with the App-V package folder access that causes the access control list to be handled incorrectly.

Addresses issue that causes a delay when searching for new printers to add.

Addresses issue where users may not be able to change passwords on the remote logon screen if the password has expired.

Addresses issue where custom application defaults are sometimes not imported when using the DISM command.

Addresses issue originally called out in KB4056890 where calling CoInitializeSecurity with the authentication parameter set to RPC_C_AUTHN_LEVEL_NONE resulted in the error STATUS_BAD_IMPERSONATION_LEVEL.

Addresses issue where an Azure point-to-site VPN connection that uses IKEv2 may fail when the user's device contains a large number of trusted root certificates.

If you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.

After installing this update, servers where Credential Guard is enabled may experience an unexpected restart with the error, "The system process lsass.exe terminated unexpectedly with status code -1073740791. The system will now shut down and restart."

Editing some group policies using GPMC or AGPM 4.0 may fail with error "The data present in the reparse point buffer is invalid. (Exception from HRESULT: 0x80071128)" after installing this update on a domain controller.